(ws-wss4j) branch master updated: WSS-712 - SignatureDigestAlgorithm of SAMLCallback not taken into account (#749)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git


The following commit(s) were added to refs/heads/master by this push:
     new cc151c6a9 WSS-712 - SignatureDigestAlgorithm of SAMLCallback not taken 
into account (#749)
cc151c6a9 is described below

commit cc151c6a9284478700ca6a59874707b8e2875dcc
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Tue Oct 13 06:57:39 2026 +0100

    WSS-712 - SignatureDigestAlgorithm of SAMLCallback not taken into account 
(#749)
---
 .../wss4j/dom/action/SAMLTokenUnsignedAction.java  |  3 +-
 .../apache/wss4j/dom/saml/SamlTokenActionTest.java | 58 ++++++++++++++++++++++
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git 
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java
 
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java
index f7cc633f9..b7f0ab02d 100644
--- 
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java
+++ 
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java
@@ -63,7 +63,8 @@ public class SAMLTokenUnsignedAction implements Action {
                 samlCallback.getIssuerCrypto(),
                 samlCallback.isSendKeyValue(),
                 samlCallback.getCanonicalizationAlgorithm(),
-                samlCallback.getSignatureAlgorithm()
+                samlCallback.getSignatureAlgorithm(),
+                samlCallback.getSignatureDigestAlgorithm()
             );
         }
 
diff --git 
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java
 
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java
index 9963c72a7..e8b2e309a 100644
--- 
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java
+++ 
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java
@@ -27,9 +27,12 @@ import javax.security.auth.callback.CallbackHandler;
 
 import org.apache.wss4j.common.util.SOAPUtil;
 import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.NodeList;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.crypto.CryptoFactory;
 import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.common.saml.SAMLCallback;
 import org.apache.wss4j.common.saml.SamlAssertionWrapper;
 import org.apache.wss4j.common.util.XMLUtils;
 import org.apache.wss4j.dom.WSConstants;
@@ -295,6 +298,61 @@ public class SamlTokenActionTest {
         assertTrue(receivedSamlAssertion.isSigned());
     }
 
+    @Test
+    public void testSignedSAML2AssertionActionWithDigestAlgorithm() throws 
Exception {
+        final WSSConfig cfg = WSSConfig.getNewInstance();
+        final RequestData reqData = new RequestData();
+        reqData.setWssConfig(cfg);
+        reqData.setUsername("wss40");
+
+        CallbackHandler callbackHandler = new KeystoreCallbackHandler();
+
+        SAML2CallbackHandler samlCallbackHandler = new SAML2CallbackHandler();
+        samlCallbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN);
+        samlCallbackHandler.setIssuer("www.example.com");
+        samlCallbackHandler.setSignAssertion(true);
+        samlCallbackHandler.setIssuerCrypto(crypto);
+        samlCallbackHandler.setIssuerName("wss40");
+        samlCallbackHandler.setIssuerPassword("security");
+
+        final String digestAlgorithm = 
"http://www.w3.org/2001/04/xmlenc#sha512";;
+        CallbackHandler digestCallbackHandler = callbacks -> {
+            samlCallbackHandler.handle(callbacks);
+            ((SAMLCallback) 
callbacks[0]).setSignatureDigestAlgorithm(digestAlgorithm);
+        };
+
+        java.util.Map<String, Object> config = new java.util.TreeMap<>();
+        config.put(WSHandlerConstants.SAML_CALLBACK_REF, 
digestCallbackHandler);
+        reqData.setMsgContext(config);
+
+        final Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+        CustomHandler handler = new CustomHandler();
+        HandlerAction action = new HandlerAction(WSConstants.ST_UNSIGNED);
+        handler.send(
+            doc,
+            reqData,
+            Collections.singletonList(action),
+            true
+        );
+        if (LOG.isDebugEnabled()) {
+            String outputString = XMLUtils.prettyDocumentToString(doc);
+            LOG.debug(outputString);
+        }
+
+        NodeList digestMethods = 
doc.getElementsByTagNameNS(WSConstants.SIG_NS, "DigestMethod");
+        assertEquals(1, digestMethods.getLength());
+        assertEquals(digestAlgorithm, ((Element) 
digestMethods.item(0)).getAttributeNS(null, "Algorithm"));
+
+        WSHandlerResult results = verify(doc, callbackHandler);
+        WSSecurityEngineResult actionResult =
+            results.getActionResults().get(WSConstants.ST_SIGNED).get(0);
+
+        SamlAssertionWrapper receivedSamlAssertion =
+            (SamlAssertionWrapper) 
actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
+        assertNotNull(receivedSamlAssertion);
+        assertTrue(receivedSamlAssertion.isSigned());
+    }
+
     private WSHandlerResult verify(
         Document doc, CallbackHandler callbackHandler
     ) throws Exception {